基于NetFlow技术的网络安全态势评估研究  

Study of Network Security Situation Assessment Based on NetFlow Technology

作　　者：李涛[1] 李飞[1] 张刚[1] 

机构地区：[1]成都信息工程学院网络工程学院,四川成都610225

出　　处：《现代电子技术》2011年第5期117-120,共4页Modern Electronics Technique

基　　金：四川省科技厅科研项目(20082R0090)

摘　　要：针对网络安全状况评估难以量化的问题,在考虑了影响网络安全的诸多因素后,提出了基于NetFlow的安全态势评估模型。该模型从对网络服务的攻击入手,采用层次化的评估策略,通过对各威胁要素的量化计算得出各服务的风险值及主机的安全指数和防御指数,解决了网络安全状况难以量化的问题,进而评估出整个网络的安全态势。仿真实验提供了两种对比结果,结果表明,考虑到防御指数的方法能更好地反映网络的安全态势,且误差较小,从而为安全管理人员的正确决策提供帮助。In allusion to the current situation of network security assessment which is hard to be quantified,a network security situation assessment model based on NetFlow is proposed after considering many factors that affect network security.Proceeding from the attacks to network services,the hierarchical assessment strategy was adopted,and the risk value of each service,the host security index and defense index were obtained by model through the quantization calculation of different threatening elements.Meanwhile the problem mentioned above was solved and the evaluation of the security situation for the entire network was realized.Two comparative results are offered according to a simulation experiment.The results show that the method to consider the defense index can better reflect the network security situation and assist the security administrator to make correct decisions.

关 键 词：网络态势 网络服务 态势建模 NETFLOW 

分 类 号：TN915-34[电子电信—通信与信息系统]